f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0

Analysis

user interaction
yes
max time kernel
109s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UI.exe
Size 16.4MB
Sample260803-vmfytace89
SHA256 f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0
MD5 a2b6b7198b6699f866a745c8ba55c2c1
SHA1 ab063e32b77137604c214916dffce1b5a3871cd5
SHA512 c158333918433e47c3c08901034b85ba99894ee37a719520c358618d74555f0bc19af2c2f274a6f4005a56d42a814ee804d8e684191084c46437e78ec751fff5
SSDEEP 196608:5sC0dlkPaQbao2Faaya8l0S7oo3TwhRCuMqoW:l0d0uFaayFso3TwhRX
TLSH
T1A30706257B5A996DC05AC4B4834B8B72497130DB0B39B9FF449492382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3808	UI.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 45 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3564	tasklist.exe
4376	tasklist.exe
4548	tasklist.exe
4760	tasklist.exe
832	tasklist.exe
4892	tasklist.exe
2228	tasklist.exe
4768	tasklist.exe
1244	tasklist.exe
2844	tasklist.exe
1804	tasklist.exe
1628	tasklist.exe
3944	tasklist.exe
3044	tasklist.exe
3696	tasklist.exe
4732	tasklist.exe
1244	tasklist.exe
4352	tasklist.exe
4016	tasklist.exe
1828	tasklist.exe
4572	tasklist.exe
748	tasklist.exe
1888	tasklist.exe
1800	tasklist.exe
3548	tasklist.exe
3516	tasklist.exe
1808	tasklist.exe
4160	tasklist.exe
4356	tasklist.exe
1244	tasklist.exe
1124	tasklist.exe
1220	tasklist.exe
540	tasklist.exe
2480	tasklist.exe
4308	tasklist.exe
692	tasklist.exe
1128	tasklist.exe
5028	tasklist.exe
2164	tasklist.exe
4056	tasklist.exe
3844	tasklist.exe
4372	tasklist.exe
2756	tasklist.exe
1908	tasklist.exe
3444	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3516	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe
4628	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3096	PING.EXE

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1700	netstat.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1700	netstat.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302504090743966"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3096	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1572	msedgewebview2.exe
3220	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	tasklist.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeIncreaseQuotaPrivilege	3516	powershell.exe
Token: SeSecurityPrivilege	3516	powershell.exe
Token: SeTakeOwnershipPrivilege	3516	powershell.exe
Token: SeLoadDriverPrivilege	3516	powershell.exe
Token: SeSystemProfilePrivilege	3516	powershell.exe
Token: SeSystemtimePrivilege	3516	powershell.exe
Token: SeProfSingleProcessPrivilege	3516	powershell.exe
Token: SeIncBasePriorityPrivilege	3516	powershell.exe
Token: SeCreatePagefilePrivilege	3516	powershell.exe
Token: SeBackupPrivilege	3516	powershell.exe
Token: SeRestorePrivilege	3516	powershell.exe
Token: SeShutdownPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeSystemEnvironmentPrivilege	3516	powershell.exe
Token: SeRemoteShutdownPrivilege	3516	powershell.exe
Token: SeUndockPrivilege	3516	powershell.exe
Token: SeManageVolumePrivilege	3516	powershell.exe
Token: 33	3516	powershell.exe
Token: 34	3516	powershell.exe
Token: 35	3516	powershell.exe
Token: 36	3516	powershell.exe
Token: SeDebugPrivilege	1700	netstat.exe
Token: SeDebugPrivilege	4572	tasklist.exe
Token: SeDebugPrivilege	748	tasklist.exe
Token: SeDebugPrivilege	1888	tasklist.exe
Token: SeDebugPrivilege	4376	tasklist.exe
Token: SeDebugPrivilege	4548	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeDebugPrivilege	1800	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	692	tasklist.exe
Token: SeDebugPrivilege	4760	tasklist.exe
Token: SeDebugPrivilege	2844	tasklist.exe
Token: SeDebugPrivilege	2756	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	1128	tasklist.exe
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	1804	tasklist.exe
Token: SeDebugPrivilege	4372	tasklist.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	1908	tasklist.exe
Token: SeDebugPrivilege	1628	tasklist.exe
Token: SeDebugPrivilege	3944	tasklist.exe
Token: SeDebugPrivilege	4352	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	832	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	4892	tasklist.exe
Token: SeDebugPrivilege	2164	tasklist.exe
Token: SeDebugPrivilege	2228	tasklist.exe
Token: SeDebugPrivilege	4016	tasklist.exe
Token: SeDebugPrivilege	4768	tasklist.exe
Token: SeDebugPrivilege	3516	tasklist.exe
Token: SeDebugPrivilege	4056	tasklist.exe
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	1220	tasklist.exe
Token: SeDebugPrivilege	3696	tasklist.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	4732	tasklist.exe
Token: SeDebugPrivilege	1808	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1084	UI.exe
3808	UI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3564	1084	UI.exe	88
PID 1084 wrote to memory of 3516	1084	UI.exe	91
PID 1084 wrote to memory of 1700	1084	UI.exe	93
PID 1084 wrote to memory of 1572	1084	UI.exe	95
PID 1572 wrote to memory of 1852	1572	msedgewebview2.exe	96
PID 1572 wrote to memory of 3116	1572	msedgewebview2.exe	97
PID 1572 wrote to memory of 3116	1572	msedgewebview2.exe	97
PID 1572 wrote to memory of 3116	1572	msedgewebview2.exe	97
PID 1572 wrote to memory of 3284	1572	msedgewebview2.exe	98
PID 1572 wrote to memory of 1128	1572	msedgewebview2.exe	99
PID 1572 wrote to memory of 1128	1572	msedgewebview2.exe	99
PID 1572 wrote to memory of 3300	1572	msedgewebview2.exe	100
PID 1572 wrote to memory of 3300	1572	msedgewebview2.exe	100
PID 1572 wrote to memory of 3300	1572	msedgewebview2.exe	100
PID 1084 wrote to memory of 4572	1084	UI.exe	101
PID 1084 wrote to memory of 748	1084	UI.exe	104
PID 1084 wrote to memory of 1888	1084	UI.exe	108
PID 1084 wrote to memory of 4376	1084	UI.exe	110
PID 1084 wrote to memory of 4548	1084	UI.exe	112
PID 1084 wrote to memory of 4308	1084	UI.exe	114
PID 1084 wrote to memory of 1800	1084	UI.exe	116
PID 1084 wrote to memory of 1244	1084	UI.exe	118
PID 1084 wrote to memory of 692	1084	UI.exe	120
PID 1084 wrote to memory of 4760	1084	UI.exe	122
PID 1084 wrote to memory of 2844	1084	UI.exe	124
PID 1084 wrote to memory of 3368	1084	UI.exe	127
PID 3368 wrote to memory of 4628	3368	cmd.exe	129
PID 4628 wrote to memory of 3096	4628	cmd.exe	131
PID 4628 wrote to memory of 3808	4628	cmd.exe	132
PID 3808 wrote to memory of 2756	3808	UI.exe	133
PID 3808 wrote to memory of 3220	3808	UI.exe	135
PID 3220 wrote to memory of 1732	3220	msedgewebview2.exe	136
PID 3220 wrote to memory of 2304	3220	msedgewebview2.exe	137
PID 3220 wrote to memory of 2304	3220	msedgewebview2.exe	137
PID 3220 wrote to memory of 2304	3220	msedgewebview2.exe	137
PID 3220 wrote to memory of 452	3220	msedgewebview2.exe	138
PID 3220 wrote to memory of 3992	3220	msedgewebview2.exe	139
PID 3220 wrote to memory of 3992	3220	msedgewebview2.exe	139
PID 3220 wrote to memory of 788	3220	msedgewebview2.exe	140
PID 3220 wrote to memory of 788	3220	msedgewebview2.exe	140
PID 3220 wrote to memory of 788	3220	msedgewebview2.exe	140
PID 3808 wrote to memory of 1244	3808	UI.exe	142
PID 3808 wrote to memory of 1128	3808	UI.exe	145
PID 3808 wrote to memory of 3844	3808	UI.exe	147
PID 3808 wrote to memory of 4356	3808	UI.exe	149
PID 3808 wrote to memory of 1804	3808	UI.exe	151
PID 3808 wrote to memory of 4372	3808	UI.exe	153
PID 3808 wrote to memory of 5028	3808	UI.exe	155
PID 3808 wrote to memory of 1908	3808	UI.exe	157
PID 3808 wrote to memory of 1628	3808	UI.exe	159
PID 3808 wrote to memory of 3944	3808	UI.exe	161
PID 3808 wrote to memory of 4352	3808	UI.exe	163
PID 3808 wrote to memory of 1244	3808	UI.exe	165
PID 3808 wrote to memory of 3548	3808	UI.exe	167
PID 3808 wrote to memory of 832	3808	UI.exe	169
PID 3808 wrote to memory of 1124	3808	UI.exe	171
PID 3808 wrote to memory of 4892	3808	UI.exe	173
PID 3808 wrote to memory of 2164	3808	UI.exe	175
PID 3808 wrote to memory of 2228	3808	UI.exe	177
PID 3808 wrote to memory of 4016	3808	UI.exe	179
PID 3808 wrote to memory of 4768	3808	UI.exe	181
PID 3808 wrote to memory of 3516	3808	UI.exe	183
PID 3808 wrote to memory of 4056	3808	UI.exe	185
PID 3808 wrote to memory of 3044	3808	UI.exe	187

C:\Users\Admin\AppData\Local\Temp\UI.exe
"C:\Users\Admin\AppData\Local\Temp\UI.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\system32\netstat.exe
  "netstat" -ano -p TCP
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1084.2304.17844441820283923618
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffe0cd0b078,0x7ffe0cd0b084,0x7ffe0cd0b090
    3⤵
    PID:1852
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,7123759040758548427,9187032380925326024,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,7123759040758548427,9187032380925326024,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1748,i,7123759040758548427,9187032380925326024,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,7123759040758548427,9187032380925326024,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:3300
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1800
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" /b C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\UI.exe
      "C:\Users\Admin\AppData\Local\Temp\UI.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3808.2648.11110720414366206874
        5⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3220
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ffe0cd0b078,0x7ffe0cd0b084,0x7ffe0cd0b090
        6⤵
        
        PID:1732
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1908,i,3266190977439952877,4331397432350461386,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
        6⤵
        
        PID:2304
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1824,i,3266190977439952877,4331397432350461386,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
        6⤵
        
        PID:452
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,3266190977439952877,4331397432350461386,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
        6⤵
        
        PID:3992
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3552,i,3266190977439952877,4331397432350461386,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
        6⤵
        
        PID:788
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4892
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3516
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1220
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:540
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        
        PID:3444
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        
        PID:1828
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        
        PID:2480
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        
        PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_yu4z5vtx.hci.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yu4z5vtx.hci.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cosmic_ui_update.bat

Path C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
Size 340B
SHA256 7058d95695ce73764a5e89fe312ee54ed0379ebb15eec833324ec02bb2f735a1
MD5 bca7a5375609b20dcc7f68df6e196fe9
SHA1 33a58ace5caa4ee19600a036b11c78836d36266c
SHA512 a4310f9ea2ab040b33f3e498a46eb902a662f65e2516b87d3de1e9da86d074c53466b11a4b0f58345123dac2a6934277747f3efb04de76236aa93f3c64bffeb4
TLSH
T119E026174183C95E242868020EBE238FD5AE8C8D2B0D7BD88274C80F214F11CFBC96AA
MD5 SHA1 SHA512 TLSH

Submit Download

ui_update.exe

Path C:\Users\Admin\AppData\Local\Temp\ui_update.exe
Size 16.8MB
SHA256 72094291f65421f2fe386e88ae9ed80cb224986bb8fe7e14619ac92ace00d2d1
MD5 8bd7d9adf4ba5b4bee41b499a7d8cd18
SHA1 5df6d8512bb5a96ba3595b656611dac5fcba1dec
SHA512 28bc1be849f82d86b14b2c453e15b3e5d4976067bbdedb102ceb9b631166c703b7a13d71a00b348a4092f2da1d88a5ada4d76625511e7fde657b902dbcd8e4bd
SSDEEP 393216:By7AsyOLF2xBsupdKhIaq5uXFaayFsJT/:M7AsyOLF2xBsupdKhfq5uXUDsF
TLSH
T16C0718257B5A996DD09BC47483478AA20A7030DB0F39B9FF5485963C2F79BF46F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c7db9df054260b6ff18ca02e1b6aefe3d97c4e9a318a0b483d2f7e51858ac73e
MD5 59f1bba6e7ad2422409b1e3f47df0612
SHA1 47325720d8382ff1379e000a393840d62d98eed8
SHA512 ddfc60d5b72d6c80423ce99bead3ec7be5db6d7673bf5fee467e78c4e1789bf89713446950c295a066d2b6b49ea2a5832c0ac6ddf9d8269c931fcb52827ad8e9
TLSH
T1C1D004505F4135C0D7513537511043001504D431441157043D51C1040C40440111D101
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 021cee0c019baf08dbc1ab2de4bfee2d27b11425476da4c26bf93d766abcf1d6
MD5 56358ec5df94713e64aa48401a15e523
SHA1 464a9b7d5387e4057c75d374da2509a13fcc0810
SHA512 08b07289d3715306c5377186b7969f6434ef6ce66aab7908e14035bebe8ab08528defdaf09cee8819a8248ce1b9f49b1004f7f9e776b38eda93e5cea2907af1d
TLSH
T13FD02BA227161AB0C72032378181E2482400C13F400685043F36FA1C0E404E10D89942
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 66b30e75e575d3e0f4b9048e6dcf4406cb98bc601dec1207c6708995a7a770d7
MD5 e794690391dde71a1439f9cc3f895efd
SHA1 64d98bb3df08f1253b15582637592686d2817ec2
SHA512 803682dc65c679f8b0bbcfc0871bd18102bac40603ca5c4ef5eb2c3122ef412e461865cbf1e94ad110e731ba888fa6f02a065f9af682313a0be310e3f97905e1
TLSH
T174D0C0F537061E71C330353380C1D1443940C12F1086821C3D31EBBC0DA4CD3199C4C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 447c0ef51a692908a9d122c22a89553e801dc25c999ef5ac1e9a59ffacad4747
MD5 aa025889ddc85b42697d6649f2c61ef1
SHA1 884134f536fe2356d7add5d9fec160eaafb3b6b4
SHA512 f6d42f15f0a5c8ee5537298e4cb4a2792f4b7418de166c5a76ff06288ba39597fed6969eb8ee17e8c49cef3a6d8ab10ea39e5a4c48cf839f20c72b03af6df7c8
TLSH
T13ED022A53A062A71C32036328080D1442A40C02A108682182D31DABC0DA489319984C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 56e803e29e848a1fe0abb101aed3459e9203f5a4535fcca055c9b0623199247d
MD5 9f1c3458ab24b5d314e22e22bff4b6e5
SHA1 fe21083bbf6dba93de8eea1b97313e0514887920
SHA512 5f460cd8cc5aa5a0243ccfcef48a39e3f5ad8a988749eefb313172cc477be9a25c344c9da77eb968854ada1b812328ec858b58335df2328fb0455c011f80bfd8
TLSH
T124D012123B4216B4C5203533110262081800D12B800581047C29C61D1E044901A1A442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ea405ad3bbc5aac6719d36cecfae4e539d915e3fe7feb301bbb5b402acbdde9b
MD5 f7313e3dd50cc5bb078695f7452edf85
SHA1 4985fc8b669e80cb34adb1454b6af15d752c5cd6
SHA512 4f409174661a0817139f224ecbb57fe9fbac3efb2aa6bf1e0f0ab25d733ffa23eaa3afee840941aa9aace7949b1cf74d1f560ec9db7352bca59f7057f9e4004f
SSDEEP 3:MsFlthltllu8veyf1+fl8tb4x1rGFsDrJbey2N//eq91kYTK6S+6Po/l:/F88SN8urGef+V/eqE+r9/
TLSH
T180134CAC66F06D8FEA55253860C39B706730DC105551D79703F07FEFB9496312409160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 271d4769ae69531a42bb986bed7a373004652cfab4cda7e5b99e8d5c2311d43c
MD5 08d4b7fd7076a82505d645fd568a44af
SHA1 90350e0ba9d8f433abc4b705fa4f82ad7055f566
SHA512 f6a9b8c2f7a7f847a343487564eac793ec3037937b345d8c6411bdee033a6abd036bacdab1975eb1b98dad484b484395de3e829f86f36d71f6681a29e77bd89f
SSDEEP 48:AzxmpbGpfGhV12Jqkto6U7w0U8OT/m6GTHm2NiW9eK:SxmxyG1GWJY8OO6GTHm2NP
TLSH
T1E344B7DE8706D49AF12181B878E47D3B492B889705D99F66B891EC4680EBBC50551A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 224a5593635d54598218503a82ebdefb81f499ecc1984ca453f3fdc3a81008a9
MD5 f075357d396182921fa46abff16b1819
SHA1 73e26ca1a04a27c10a402fbce4265f14e341ad19
SHA512 212bda945467ef49820fbb5e3223034666dda3f115ee43176565fa96fd0e938853f3512a3a908edd324ca5f021b2bc214bea2953c9b72d552b9b33afecbba8e2
SSDEEP 48:N6sx8WlPFBXdqitAUnJtHOFwalcvTNuvQGP6YrhWPaUYF:rxRFBtqnUnHuGvTNgbP67e
TLSH
T159250C822EED9949DC284779B6B65C8571B4F8D0314F657C0CD1BB5D71FA0E117D3828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 699140df24e3ef827cb7f640d75912845c7678eaa32a2148b2b8ef6bfa53fbad
MD5 c749c0b5c505a99e1e41be9315a8ab0a
SHA1 d5feca842f47a94cc65173577c10b14330395fd4
SHA512 86bffc0b216490f91990869870a1bb6d36ee68ac533181f95e26dd7727aaef9628b7d43ed00796be1c89306c7958dca4874aec11fb627d4b803f4a9395b685f0
SSDEEP 384:QGAn9aQu+JEYiWAn9aQu+JEYiCAn9aQu+JEYfi8QQu+JEY:QxMgihMgiNMg5Mg
TLSH
T1E1163BEB4F74A54AEA01EB70ABC4DD2C7CF046A77D87A8D2A50681E918E0BC4274615E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\f_000001
Size 71KB
SHA256 2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
MD5 4b73e2ff3024784eca66d2120a9bcb22
SHA1 2870bcb8ece10145e089262bb6634d18ac85bec6
SHA512 9ebe0b2cc7ed7298d931fc246732ed90881f0252b957afbf14f390c75c1da3fddf1b3fbb00be8d489cbb7b5a18f9dbda17a24e18594d44ebba4b7ca3f50bb10a
SSDEEP 1536:MO6PxhqwEppt5fUo8w4d+X5JlhLzcua67BYePELa:M3qh7VdDf8GPH
TLSH
T1F0630245820BA35EE09D4A79D27481F61FC2CB5C2BBF5C27538289AB5F57DBF6410134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 f3612d0e3c5cfa4bf7cb7f21a78423530adedf187b81453975a70d3c052d77eb
MD5 eba73fb5f95156f2c10b3191a7e58232
SHA1 112a2d2841ef946a476d548b65064d491207c6ef
SHA512 bde185d8ad127da7f81e1ba5f14a2b0ce32dc7a2dbd21e1ee0eee2fa2f4f1adceca74706f26405718fddf328912cff663a9b6cbe6a83d4ecb3b9107909729a3a
SSDEEP 3:LsYllfltlNllkll/lt6GKckltlBll8ncNtlB/3ll//9lXl:Lso13lEtt6GKPtlBNxdl/
TLSH
T16144022D93E14C19DB9099FC46078F301364C41089CFC3471304C1753CC17500E0B084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2223ee708600aff3_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\2223ee708600aff3_0
Size 265B
SHA256 cefe378235351979f006cc72c781491223e96b131c6456c474a0ebd8f28c65dc
MD5 f9407f8f420b0081fc77dd629732232d
SHA1 10367b8a728099b78f1c67311b1ec5798e4dddf8
SHA512 861cc00d3c007bd30f053f41191424626353a937bf97fd54854d71843ca634b5929a7c5d9d8f29d507224acdbd77b23316f645dc5e2a03c170c7c8e553e510b5
TLSH
T15BD0978F8831FC0AE1CF8EF0D3EA4B0F833A80B0802CD8107000EAA83AC0238381C700
MD5 SHA1 SHA512 TLSH

Submit Download

3ad623ae869b34b5_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\3ad623ae869b34b5_0
Size 265B
SHA256 63c988a2b30ecd74ec78962c18312d0da114f7765105ecc5bd54e97fade444e6
MD5 081786fc544aee5280a60fd64d3bbb78
SHA1 b99837b672ff08db8b75ee9866dea72fca343c4a
SHA512 5e6b59650460ac932d46bf1a34c56320089bd550829690f9cb253768026a071199eb12b7a1205c88ee51d4c2146ceec6bf3d6e5116ffbadf5b0eb625fdd9ffd7
TLSH
T1C6D0958F8619F407C054FDF8DEFD870D9207C1F0601DACC21111D4C9314036C3518300
MD5 SHA1 SHA512 TLSH

Submit Download

47b41a32c37a9401_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\47b41a32c37a9401_0
Size 265B
SHA256 e7362755310fc7737d6c55c63ea3532cb498e0b8aa72569bb8e5dd7d28809a09
MD5 9adfe69b259d97f6ae23324497b46626
SHA1 6d5da292c26ef34daee3daf5a00a38d25a0ed2dd
SHA512 9e92953a8e13d29226bee8a19b87295f6b4a6b9b8cac87ff915620d4d827b90680810e6f481f5c907312b99b3badde4efda8845f14877882866a85bb7477e3d0
TLSH
T188D0978F0A09A80AD0AE9DF0E6EF4F1EC30E4AF0C02CB8412103F0D22590734FA48350
MD5 SHA1 SHA512 TLSH

Submit Download

57357386120da46a_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\57357386120da46a_0
Size 265B
SHA256 52389d2863942a63a1980e28c76e44619a08efc672d7153b167476fbba95011f
MD5 526ed89e5bc4a77731c0b0de51f2cced
SHA1 403a75fa086980fd9fa75f88f572a905cc9310e5
SHA512 c1e7459517ac913446ae6a7596ba18a707e609a9bec1cb12af2a5cac0e14558961f0dbae6bde8bc07db42d374eaa6d2f32e2d7c28b97c72001b32da6b18ddf99
TLSH
T18ED0A54F4D159509D15BDDF0D6DE4F0E820A44F09518D4815015E89D31D0729B95D70F
MD5 SHA1 SHA512 TLSH

Submit Download

a094f4fcb0bc2962_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\a094f4fcb0bc2962_0
Size 268B
SHA256 32221a34b56b4edcdaa3ff963cea07d11d688cf7d16acfe53be54405e8e090ed
MD5 db834b40c26c7338f404c98ae5383506
SHA1 1d63f71aa1d7f98922fc141e8caa01ca3d9aa129
SHA512 95b28099ea9d360dc6a6eec64aa8e4826685693e92bd834a7eb9be36fffd910b119eee08b8e8a213e61362589773dc15610ec3dfef5e5cee74ecca18bbb9ac90
TLSH
T131D0958FCD641106C3669BF05BFA570FC60F40F055EC60011149F4D925E1114353CB00
MD5 SHA1 SHA512 TLSH

Submit Download

ba005ce25f7b24ba_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\ba005ce25f7b24ba_0
Size 266B
SHA256 3a63fec284b7b7336a269caae5f17aac941b8785588b79413e3d7bb3c85e8135
MD5 54e807dd9ea9ee569324f01b617e7513
SHA1 ecd295feb471eeed7cd4aaf16e63b1bd1c01f5ed
SHA512 e0df59334e4ae13a54902e1d66cf7a16ebbaa347d46ebc13106471af8c7e0b0711705dc79f85b64f3622caa2751c27244d0ec32ac56b98f0f94f270afeed2e6b
TLSH
T150D0978F1A51B108C104FAF0EFFA0F0C872B64E024AC422F4202E89629A0F2C3D6EB14
MD5 SHA1 SHA512 TLSH

Submit Download

bbade47e7e037fb8_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\bbade47e7e037fb8_0
Size 265B
SHA256 a970dc4f3e8a43f5a56e20b0160ca1268be4b54a3a85820233996fbb0fff90b1
MD5 32403f1baa6c7c879193f0fd8a9dd0e9
SHA1 b8567bbeed76bc16c9f61f238cab935c60e651d2
SHA512 59dfb2bddcab3f43c5ca18653b21b37ed410dfe99adb2ee84a365fc011ab12334923ae0ca07bd7dbc431228700ea8cbe537488c385cbe7f332b9ecfe3cff8ca1
TLSH
T19FD02ECF4C12754DD209CAF0D2EC8B2A930A40F0822840A30150F81624905283EB8A0A
MD5 SHA1 SHA512 TLSH

Submit Download

bc2154cc967d815b_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\bc2154cc967d815b_0
Size 266B
SHA256 1928f33e86fe30bba8ec44e3145c362fa3099f60592a05bd468bfa7054230e40
MD5 a97758a2ed11dc79ff3295ef4894f8a6
SHA1 47ff7708a281ff9206fb0f7a48adb52b6328975f
SHA512 fc4f5ec46e4552ef4c66757e2bddf4a918fd8080538581197f9f415d0a2a20256ef6a1f6ee3b0f694939b3098a4a34a6b9b8b24debe429022945a8f7c020134f
TLSH
T141D0978EC9238595C02AEBF7DBFF0909C30B40F850ACD8A20000E8A7A1C026C7428200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 ee725102019f235055085b9d329035c1a79c92e42728dbbaa1af24a24782bc2f
MD5 0fbafc548adfed9485aa450cdf464caf
SHA1 1a2efe865906144a9b5a37fabf574ca7b25e9eab
SHA512 55a07a8be084d41b1588d00443d10ccd8c1a537ce9f184aec1a26fcdb453dae9cc3ab99dc3edc287cafa4ccd61016330bf2fef25cfbce73404316677942fe92c
TLSH
T1A0F0A95A36B032B5EF1909B00AD4DFC03830484D32A3DDDE02C32ABAE0ADB9D4925839
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0e8fad866e0586453b29c5591f923423f4e859b032a5d64fd4c917d77ec07964
MD5 19e3cbf04a6c19df7733044ea1078898
SHA1 6b07d8f8d60a026cb22034d193ce79f4533d3a0a
SHA512 ce47f1d7a5e4aa9166f3b0bde2d8448ea0469f5e7568de009a8759db328094bec5bdc6158cf0cd7589af682633a0b2ce59f136ef0ebe9fdb9003570882a5fe64
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 24db011f8f3535abfecbf225d2b59242f4f5a9ed2c0f0ee6fa18e5b5bea764f7
MD5 dd76dd433aac0a3fcc2dacae4ec61b22
SHA1 cc8afbfe36c159e4859839b259fb22fb29f42277
SHA512 856df500a56de52f5557a42a5c59f204df1caa58ad168bb4922fa458d390110534a480b3288677734b171383ce871e14234039ce5838d69260db3fef3269012b
TLSH
T1C0D08C4CA07032F1DF9E82B414C6CF903A704C0C8173CDCA81DA22FEE408768992222C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 703d17b8ff106b1f7684c414d90fc48c2aaad69545c5adc694df7c2d062a51d6
MD5 db233ebec3f64d968c06d3362c3ddea0
SHA1 23cc3eac97e6d9590e39b5fcfd562273511883b8
SHA512 af3e2098d4f60d62f7fc5e0cacf470bbb3e94ebbfdc4ec8bfa5f366cd7987adf5b686c21668e624f0d9ec311c0ba4fcd55c1155012df8115ae76f99d19a86b2d
TLSH
T14CF04F1AB47032B8DF59457109C9DB91387048596163CCCE038336FFE49DB6C4939939
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\History
Size 184KB
SHA256 d77114229bf7eec804c911c2daee2c0ac063a838d050eb9f88b545bf911ccd53
MD5 bdadc80d84dfd389021ae325609870c3
SHA1 ea7fd63725156e9d97d859a2fd9b52c18f2120f9
SHA512 728e917f9f5a1ac181c6abd400902ff704e7c1ec1975d1ba64da3611ffae4f5178232de74b5565b052d55a8f3bd7b44e9c1787bcc81bb83f80d17cd7a4ff2c89
SSDEEP 96:HBG8CUgejzH+bF+UIYysX0fxQp97ZEHt/DfLjLqL/0bgI4VgNr2jWRk/E0kV:HBrPH+bF+UI3iWGVZWN3qL/LVgZQW3/V
TLSH
T1A604FB5E5F243212CDBD513668E649B3587DF03F8B2366D66C6108B1CEE2652B02C9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 590e5802de212b7e3e046296bc71b96db92571b69a88fb7848c10c40e6de5d5e
MD5 c5fdc4099a18d0fdb7c78d2ab93e4ef4
SHA1 9aeadc71343a5a104988a6422ce3505374240ed1
SHA512 b4a1504e08c714b418c30bf93d9b7823f71d0c803809a40d3f05bc08ce60623c0f493c7def71b2b3acfc465f88e81300f590b157b3dece30bf84afb872a99ad5
TLSH
T1940182A2C3D4C57E8A4117E567343813CD2E051692283D37DDE9EBD957E1471D21050F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58fb91.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State~RFe58fb91.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 f4721e0939b579bc05517c45ebd382dd5e45530bba70d3971ae7a48c17f6d4e6
MD5 5510573bf32a67ff3331ca43d1bca011
SHA1 9d1d0de5c2703def88ebd1e7ee720a2085fc8fbb
SHA512 08c96b212f5cc8c17aa7e1beafd1bdd6a333cdb5becb5c2f7e2afae1d708a3ca5516d5ffb1ed2f9ad843b8389cc7a107f069589cb637f2be2d5855ad20f9390e
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB1K:uIEumQv8m1ccnvS6w
TLSH
T104F29BDE0B18B614C4E49578E6C409C3BD3E142D8B96AFC59EEC06F1FF821B2A538219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 db2d26a147cf7c981f82621fafba8191c872a1893744b8a399e6be90692439de
MD5 28b586ccc34ab7a932362feccb7e235f
SHA1 eac436eea9b6dccfea57c87b5881d8989bd67f18
SHA512 09cd1710a72ba452aea5ea470de0b88106df5da64f336fc834469dacc6fd017ea7c42392164cd68f8bcefb0914d3cb09bc2d067d9e8af9b11309bd0192666650
TLSH
T194E026E340BFA1BF20682D3629447C516A3AA13582556CF8DA42887CA0805FB5A16476
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 b5af166cf164ae18a9c95f84ee4f1f5787ae1b5e5ee75a5fa35ad67b6f3f7cb6
MD5 24509820202682ca481d3f26b576687e
SHA1 9820e2a8d42622ee9c5af4b9dcfd3114e09a13b5
SHA512 2f232b9f480b9e0fb7df7d45ff2758528de4374d3ecfd2e00c3c1e53336f618ad66fa9ffe4d4177836a3372a8b28bf5a9da85390f98d4cec460a1a444feba604
TLSH
T1D5E026E342BFA1BB1068293A29447C02EE3EB23541556CE4DA42486CA0815F76A128B7
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 0ae0111731484d814fa55e217e8e73b809dd378e768594695aa083bc0b8ef6dd
MD5 894b3019c9619871fbf9ef82602de044
SHA1 d88daa749dd317c73d9591770e03b599afb2889e
SHA512 2e25ee6c1c5c448592fedb5bd0f2e9af29a559d425153f2180b5584344514e5ea16540c7780dac187f9c8a5373fe7eee8b9879d492a462481ce5f4fbeb07e482
TLSH
T145F052E3407FB5AB103A69362C447C46BA7AA57151A25CF8DA42847CA4844FB5A12072
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 80f6de7a16ed446921cb0db64eb7953268a8661174436a4cce3fd185a02d0489
MD5 d03fc12ab202005490fe7bbd796d3cb7
SHA1 8c47e52249ed18b1cc59e0fe80edb2fd4efab10e
SHA512 14ea1142e7bc32935598f077378bc9c67f8df5cb7bbccb6d0a404092412e28b6f0ffb3de277eec7057652cc643514cba324bd94f1e21e4964311be442e558bac
SSDEEP 192:st770DKImfEiZ8paiF/S+WiTdiQY+9QrepM8:st7QD+cF9/VsQH28
TLSH
T16CE1B702AE68A97B4CC7E2197E75FB56D2F9102225D00E58EBF8861C04D76DD620790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 7KB
SHA256 e8cab80e7287eb272e1b530b55e864deda13bb2b37e6751271c36905c1b6b23d
MD5 92d258b1f77c6ac97560a4f90ef619dd
SHA1 a21f9efe1f2116f9e6762a8c270f0d7c8e6b24d6
SHA512 aa331552df91a8d1bf33afda612a64c407da4f3f7e6c3093400da977b82e2a94dc1c89b159540c6006b1de8364b03ec4276e9953d757a469ed77175a2fbaa8f6
SSDEEP 192:st770DKIYfEiZ8paiF/S+WiTdiQxgm+9ADepMC:st7QDgcF9/VsQxu2C
TLSH
T13EE1B702AE68697B4CC7E6197E75BF56E2F5102225D00E98EBFC861C04D76DD6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 791c37c08a583e54bf937c8ea485ed5b4ae59a57de62e2bdcd49c0b80d136f42
MD5 9f22a7159334b91231067cc37f76daf4
SHA1 c01e01afdfd654ad77514d254a2611ebdf32ca6c
SHA512 89df963f36134708470dac02c2c8e980cd106271d49a035d14538b1db7849cf597945a0f8c6686f7fa52a1466186a1b958b4a7cdf30444bc36a25a45de3620fc
SSDEEP 192:st770DK1fEiZ8pa5J/S+WiTrwwY29KreRK8:st7QDKcFk/Vgw5A8
TLSH
T188E1DA025F68A97B4CCBE2197E75FB16E2F9106265D00E98EBFC865C08D66CD6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58fb24.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences~RFe58fb24.TMP
Size 6KB
SHA256 52695c70ecf8ee5d4766db78e27ec1fb80a072d8671d7f266ea25c3a51eeb30b
MD5 9e4cda53d18ac4ff925b9b55322aaeec
SHA1 a1da9dd527dac94d488e30a6c505f6c778df6f5d
SHA512 0c8feb86c1c907121ba4e70f4e51c45cc29ef964fb81d4e9ec6142afd9bf4c460d593f90003402375675715c66a12efbc88e1439e00afeeb0c045740f87b13d6
SSDEEP 192:st770DK1fUZ8pa5J/S+WiTrwwY29ve+M8:st7QDKjk/Vgwqv8
TLSH
T134D1B8025F6869774CCBE2197E35FB16D2F9106165D40E98EBFC865C08D66CD6207D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 75110b707a8693f2740cb50bfc95c873ddbae35a609fbe140b21323ff08f6505
MD5 b85f9903df409733dd80a62d0dc4c6ca
SHA1 12a42962418ff4c44b0c3979d1ae0929106af6fd
SHA512 4d04a9783c5f954451bcf3a293031616561f7a74bc0de4046cecd773b49832c48f294988934cc621e55e2bf6347da6d6ef2aac122b053ed3b07d79fbb25c2452
SSDEEP 96:Hlci4Plf/ROoKOpkF5d1cil7sMaTEv9V5h5pg5+eeZNc2c9uSKqIUfjLkDz:HbcWGcl9l3Ncd9uSnpLLkDz
TLSH
T157D1B8A34568D578AF445BDADC397FCACDA640DF98C54C1997D2C44C0BC2EFC21CA895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 419c26e2ee636594a9d556e176d31347d0dce2b72b27f605488f64cc87f62cf7
MD5 c2632925137b989acb750ecc6bf4f40b
SHA1 a526d92a3f6c5e2603c3d17ef895863fd4397dd3
SHA512 88d788cf7e7e6091f414205ac65e55d968d9b5777fc9cafe1a8d8fe48fc0d5f22d01c4f9e927dce844e6e79919d797b32402793333bb316decd82ef7bc7d18cf
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 8b74c54d79d68dbee02e53d0e5de39c9fede5fde1dd7dfb38ea794cb3977dc82
MD5 ff1420ffbd6e995803a34328ff30bd43
SHA1 dcf0e837b2f5fdf54ad1a535a475af3dde100366
SHA512 de041f9c3875d996f8471ad8be88b651e4013d6f3600a99807201b5c84c42951596404f7ddeebdaeb3e6bde83eb6b964c0a363578113f10d4d4b971fd93da21a
TLSH
T151B012847F04922FC1F80E3F4284C7E06324E2036910250358549F210EB63F42E00CD8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\LOG
Size 311B
SHA256 9b45d53180ad1b1ff32f0ea3d2316fc0b4959842165ad6ba31e972b9df5346fd
MD5 95d05654d6546b178b7151a4da80bdbf
SHA1 311fdb9bea2992358fe842e21dfe7798a3cb4b32
SHA512 b640dcc70b6aad587136dfd3fa70dddc7c195e3534235bd4f16780b80a3edcc425e91d4512acfcf77ad85a737bde0a7b7acf74ddb7a248ebe66b384841cd71b5
TLSH
T199E026213ACA8A375E8544EF3631B38DC6627402FADA16114EA8E2416947888B502741
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\LOG
Size 291B
SHA256 dc930056c29e7edaafdb345a9fa9be05f65007751976768e63c613f90ddc68e5
MD5 78ff3b3227523abddfdd13ee587db938
SHA1 11f14558fbe6a23e458501eb246532a548992abd
SHA512 3decf105dbf78dc86d648cfdbfab40ce56ee06e5598b88e2bd8983a1a58a9a0f005dba170edbf26e7e2ac0ef8d23850e61d4fff04d180f05d8dd31b50cdc9f42
TLSH
T107D0CD7079CD86760D40C4EB5575638DC2B0FC07A7CA37494F5895057C42848B511A42
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Visited Links
Size 128KB
SHA256 7ad4e14ad26a85738eb9cfb92f64059902eefb6e6a3e1341250b21d230548b91
MD5 bca430c69422a515463cc9bf79c6f53f
SHA1 6ef06791cae0772f553afeb20f2de46ba08e89b2
SHA512 5b590dbb56cd91cd958b368a3a97fac770d7561ad903595a8ae31ffaff060803c171d65857eaaca9390b7c0e70941b85780fb21763209ed27016c49ae4b90864
SSDEEP 3:ImtVuneyallle/N/:IiVudeeN
TLSH
T19FD304045147C510D05735F3C431150F7110C101D03101C5C735457F54C37315347C01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 1KB
SHA256 a59d6e3986ab15d99d10e6e5ae644cad450c44afbdd420b8152a6363defa63fd
MD5 6d41b7a4ab6cc7f95dbd52487f2d3382
SHA1 3ae673caed4fa78465df707b7778d2fd8df9e1ef
SHA512 e60e8c11f5d8a5fa6d48261c0b221b936bf03e09442655bf9a4210dea1d652bb2f11804a9ec55a6f141c0ddc8271d264e42252bebdb08dd3d7cf99a8e6b9b806
TLSH
T1E431A9B3E4A02B3368A12940B6D6AB5B9DB11066C1218FC4A1FF471C19EB79C8556C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 24468526f8073de92ce93d907dcb7b14c16ca32914304b3c7fac4df4bd0050cf
MD5 9df3e5a009d057714d434657bd8d36a2
SHA1 94a521caf2c3f73eaaedbc81501e5b3a911ac41c
SHA512 239a578b9edd18e8cc4adbdd127a59f909e9baecd3432a10b7d77155d7b36ee1593b8edb5f36916cee46c6a17c069475aa141c16ff1015a84991f67cf3d45519
TLSH
T1BE51C573B8546A3785F26944BE8A7F27ED715061D5661FE095FE0B1C01EB65C1302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 c6f13c198ad0463aefaa59cc37d4110265f9ca440dead860379ea9615710c5f6
MD5 53d7e9b2247fea3e056961fc9ed1f3b6
SHA1 78f221ebeb240c433e5759790766aec9ee451d54
SHA512 e866bf23e525af3c38a201c03a3c58e32ce0b8c7e4cb5aee52ed97490426a9004df7edcb7740a1a81db0ed21a71a37e0f56fa88c62d49d628c2e579538c55c3e
TLSH
T191719472A8A4A9374DF2AD40BDC66B16FAA15027D1952FE4D9FD0F0C05DB39C1342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 16KB
SHA256 be9228a859219bdb40d55985f5bb25707fc0b628492251680f9301c89bcdaf93
MD5 b859841f2c619157adf3f37f4060c367
SHA1 1840c8a5e9737fd31a868a02d23b8f8c2889f2e4
SHA512 e5501892241678a03799e07fe2d83bba8d400ea7f6b787eb578d4c888487a6d80bd31f12e8ea926ecbd7ecc227200789595db3c1b874cf7043ed3bbfaea0db12
SSDEEP 384:zx+aQikB+z/xvxjg/qhEwNbVAa4lH489zq:o/UxvxjgC+JHlH48Fq
TLSH
T114728D3794787E2755F2F904BE9D0B5BDAF594B280C15AF889FE5F0D0A8B3980342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 16KB
SHA256 91b01abb08bf5d4e8db52e7b483e36f8bd038b97c9f591f63d2674260dd280f1
MD5 b46a2fddab8cb4c4c0c74f74c9609c0b
SHA1 574a773d37182369b6cd06fb80dd4c9d65bdd0b1
SHA512 1c534d0e86d69277db13fda0defb6c711375526165340cac17a1faf1c9ae678e25e66aef383dc594622ec4cd361c5b08241d6f9ec6d1434eb973b0c32c2b441b
SSDEEP 384:zV+aQikB+z/xvxjg/qhEm3NbVZa4lHKg89zq:U/UxvxjgC+mlHlHKg8Fq
TLSH
T1C3728D3795787E2394F3F904BE5D0B5BDAB594B280C15AF889FE5F0D1A8B3A80342D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588c3d.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe588c3d.TMP
Size 1KB
SHA256 4fe886328f1c1dcd6ef7acea6aaf543b5560c7a85e83ac80f737ea9776376959
MD5 f91efd4fce3fd6623efb8e7529b4f1ee
SHA1 38ce1590e65c07d673e61833468fdb3d9e15215f
SHA512 4719f9af5931aab98ca3268664e26999fdf7d2ddc348af5fd174fd207d31126f83a82082e549587c269633e5a67d731c0f5f2b261d6e822a504735630690281d
TLSH
T19B216873D4902A3375611C40F652E75B5DE05066D1208F88E1EE531C19AF6AC8566C36
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\ShaderCache\index
Size 256KB
SHA256 09efbb3b73b7c5df285b2dbc2b6ddacf4857e4c16bc2fad3b688d0ab5aa99b53
MD5 90785b997bf267dff3070d167341f8f8
SHA1 cc2fb417edb7463401744da070037338e0eb7511
SHA512 81901800e1ea294ffbfbc5ff59ee70dd4d65fd84dd551df919dd73c9ba78e17baca76fde837d3a90829c01d50ff170c7c98739cbd38188f6e0f0d9b5e49c801f
SSDEEP 3:LsOllllklkXlChy:LsUlPCQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

ui-state.json

Path C:\Users\Admin\AppData\Roaming\Cosmic\ui-state.json
Size 2KB
SHA256 e9b99f57f5dcb9a9e2cea6b8da05c7a6dc81f636c9e72ad8222135743eac1642
MD5 d7c6a4eaff137845fe4891d73205f6b1
SHA1 f5ba8d7d0a662116dc965c6f5949fc7c2a53fdbd
SHA512 ec41ff924fe933f17e1a988d66e2cd6751760a3b1853cf5266bcfda9ecf6c06a17ad6c2a71800180cebcd47d12ad8996dbf7a2c055f54570127521a6f703d4b1
TLSH
T11A41492ACA680C7710E4762A9CED52436A7582530D593C2CB78C5A0C1F9E33F65B79ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-556-0x00000296ECD70000-0x00000296ECE0B000-memory.dmp

Download

memory/1128-241-0x0000024802B20000-0x0000024802B4B000-memory.dmp

Download

memory/1128-76-0x0000024802B50000-0x0000024802B51000-memory.dmp

Download

memory/1128-75-0x00007FFE29A20000-0x00007FFE29A21000-memory.dmp

Download

memory/2304-549-0x0000013FADC10000-0x0000013FADCAB000-memory.dmp

Download

memory/3116-240-0x000001F3CFA30000-0x000001F3CFACB000-memory.dmp

Download

memory/3116-38-0x00007FFE29640000-0x00007FFE29641000-memory.dmp

Download

memory/3300-254-0x000001D28C410000-0x000001D28C4AB000-memory.dmp

Download

memory/3300-159-0x00007FFE29640000-0x00007FFE29641000-memory.dmp

Download

memory/3516-1-0x00000225ACC50000-0x00000225ACC72000-memory.dmp

Download

memory/3516-9-0x00000225AABD0000-0x00000225AABE0000-memory.dmp

Download

memory/3516-0-0x00000225AABD0000-0x00000225AABE0000-memory.dmp

Download

memory/3516-12-0x00000225ACC80000-0x00000225ACE9C000-memory.dmp

Download

memory/3992-492-0x0000027E0A9E0000-0x0000027E0A9E1000-memory.dmp

Download

memory/3992-550-0x0000027E0A9B0000-0x0000027E0A9DB000-memory.dmp

Download